Two vulnerabilities have been reported in Microsoft Windows, which can be exploited by malicious, local users to gain escalated privileges.

1) An integer overflow error in the Ancillary Function Driver (afd.sys) "AfdPoll()" function when using the "HandleCount" value from an AFD_POLL_INFO structure to calculate the size of a buffer to allocate can be exploited to cause a pool overflow.

2) An unspecified error in afd.sys when handling input passed from user mode to the kernel can be exploited via a specially crafted program.

Successful exploitation of the vulnerabilities allows execution of arbitrary code with kernel-mode privileges.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
Tarjei Mandt, Azimuth Security.

Changelog
Further details available in Customer Area

Original Advisory
MS12-009 (KB2645640):
http://technet.microsoft.com/en-us/security/bulletin/ms12-009

Tarjei Mandt:
http://mista.nu/blog/2012/02/17/cve-2012-0148-a-deep-dive-into-afd/

Deep Links
Links available in Customer Area